{"id":"W3150814957","doi":"","title":"Lags in the release, adoption, and propagation of npm vulnerability fixes","year":2022,"lang":"en","type":"article","venue":"Institutional Repositories DataBase (IRDB)","topic":"Software Engineering Research","field":"Computer Science","cited_by":50,"is_retracted":false,"has_abstract":false,"ca_institutions":"University of Waterloo","funders":"","keywords":"Vulnerability (computing); Software package; Business; Vulnerability assessment; Computer science; Software; Computer security; Operating system; Psychology","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"codex-gemma-dda1882f352a","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.001093585,0.00009054078,0.0001013375,0.0001150124,0.0004236151,0.00008164495,0.0005976213,0.00002201548,0.000007130757],"category_scores_gemma":[0.001147973,0.00007572402,0.0000247723,0.0007130135,0.0001867652,0.0006921881,0.0005157267,0.0003000303,0.000001464023],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.000158654,"about_ca_system_score_gemma":0.0003269794,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.0003772298,"about_ca_topic_score_gemma":0.00002137989,"domain_scores_codex":[0.9982331,0.0002005319,0.0002668741,0.000314918,0.0008271843,0.000157412],"domain_scores_gemma":[0.9984999,0.0006640283,0.00006649795,0.0005990309,0.0001295398,0.00004099318],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"theoretical_or_conceptual","study_design_gemma":"observational","study_design_scores_codex":[0.0001429564,0.0007336038,0.2309671,0.000373124,0.00004106477,0.0003311211,0.002818411,0.02282721,0.007794785,0.7236863,0.003095845,0.007188485],"study_design_scores_gemma":[0.00174089,0.0006079531,0.8509576,0.0002237243,0.00002475388,0.001417226,0.0006863556,0.03618246,0.01507711,0.005359488,0.086888,0.0008344527],"study_design_candidate":"observational","study_design_consensus":null,"genre_codex":"empirical","genre_gemma":"empirical","genre_scores_codex":[0.9016594,0.0005069123,0.09485693,0.0009673658,0.0009508745,0.0004568595,0.0001504571,0.0001172357,0.000334005],"genre_scores_gemma":[0.9946117,0.00001142739,0.005001459,0.00004109803,0.00009086748,0.0001405469,0.00007943955,0.00000367387,0.00001975364],"genre_candidate":"empirical","genre_consensus":"empirical","teacher_disagreement_score":0.7183268,"threshold_uncertainty_score":0.3258148,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.01786123814436419,"score_gpt":0.2611345482604494,"score_spread":0.2432733101160852,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}